Re: [PATCH 1/1] media: rc: igorplugusb: quiesce callbacks before unregister

[Sean Young]

On Thu, Sep 24, 2026 at 10:53:51AM +0800, Yuanzhe Liu wrote:
> igorplugusb_disconnect() unregisters the rc device before poisoning its
> URB. rc_unregister_device() stops the raw-IR kthread, but a completion
> callback that is already running can still call ir_raw_event_handle().
> This makes wake_up_process() dereference the kthread's freed task_struct
> and triggers a KASAN use-after-free in try_to_wake_up().

This is problem with the framework rather than the driver. The
media-committers tree already contains a fix for this issue:

https://gitlab.freedesktop.org/linux-media/media-committers/-/commit/3ae19773168104fa57d2a2ec57731e89df54175f

> Poison the URB and delete the timer before unregistering the rc device.
> Poisoning drains any active callback and prevents resubmission, while
> deleting the timer stops the other URB producer. No callback can then
> reach rc-core after its raw-IR kthread has been stopped.

Stopping all the urbs before calling rc_unregister_device() isn't really an
option for all drivers. Users can still do various ioctl/write on the lirc
chardev which could bring various URBs back into flight. For receive-only IR
devices like igorplugusb this might not be an problem.

Thanks,

Sean

> 
> Fixes: b1c97193c643 ("[media] rc: port IgorPlug-USB to rc-core")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yuanzhe Liu <25031212351@xxxxxxxxxxxxxxxxx>
> ---
>  drivers/media/rc/igorplugusb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
> index b5117ee..42e05b9 100644
> --- a/drivers/media/rc/igorplugusb.c
> +++ b/drivers/media/rc/igorplugusb.c
> @@ -241,9 +241,9 @@ static void igorplugusb_disconnect(struct usb_interface *intf)
>  {
>  	struct igorplugusb *ir = usb_get_intfdata(intf);
>  
> -	rc_unregister_device(ir->rc);
>  	usb_poison_urb(ir->urb);
>  	timer_delete_sync(&ir->timer);
> +	rc_unregister_device(ir->rc);
>  	usb_set_intfdata(intf, NULL);
>  	usb_unpoison_urb(ir->urb);
>  	usb_free_urb(ir->urb);
> -- 
> 2.45.1.windows.1
>